linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org,
	Vamshi K Sthambamkadi <vamshi.k.sthambamkadi@gmail.com>,
	David Laight <David.Laight@aculab.com>,
	Ard Biesheuvel <ardb@kernel.org>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.4 18/24] efivarfs: revert "fix memory leak in efivarfs_create()"
Date: Tue,  1 Dec 2020 09:53:24 +0100	[thread overview]
Message-ID: <20201201084638.661650900@linuxfoundation.org> (raw)
In-Reply-To: <20201201084637.754785180@linuxfoundation.org>

From: Ard Biesheuvel <ardb@kernel.org>

[ Upstream commit ff04f3b6f2e27f8ae28a498416af2a8dd5072b43 ]

The memory leak addressed by commit fe5186cf12e3 is a false positive:
all allocations are recorded in a linked list, and freed when the
filesystem is unmounted. This leads to double frees, and as reported
by David, leads to crashes if SLUB is configured to self destruct when
double frees occur.

So drop the redundant kfree() again, and instead, mark the offending
pointer variable so the allocation is ignored by kmemleak.

Cc: Vamshi K Sthambamkadi <vamshi.k.sthambamkadi@gmail.com>
Fixes: fe5186cf12e3 ("efivarfs: fix memory leak in efivarfs_create()")
Reported-by: David Laight <David.Laight@aculab.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/efivarfs/inode.c | 2 ++
 fs/efivarfs/super.c | 1 -
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/efivarfs/inode.c b/fs/efivarfs/inode.c
index e2ab6d0497f2b..151884b95ee2f 100644
--- a/fs/efivarfs/inode.c
+++ b/fs/efivarfs/inode.c
@@ -10,6 +10,7 @@
 #include <linux/efi.h>
 #include <linux/fs.h>
 #include <linux/ctype.h>
+#include <linux/kmemleak.h>
 #include <linux/slab.h>
 
 #include "internal.h"
@@ -138,6 +139,7 @@ static int efivarfs_create(struct inode *dir, struct dentry *dentry,
 	var->var.VariableName[i] = '\0';
 
 	inode->i_private = var;
+	kmemleak_ignore(var);
 
 	efivar_entry_add(var, &efivarfs_list);
 	d_instantiate(dentry, inode);
diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
index 0e4f20377d196..fca235020312d 100644
--- a/fs/efivarfs/super.c
+++ b/fs/efivarfs/super.c
@@ -23,7 +23,6 @@ LIST_HEAD(efivarfs_list);
 static void efivarfs_evict_inode(struct inode *inode)
 {
 	clear_inode(inode);
-	kfree(inode->i_private);
 }
 
 static const struct super_operations efivarfs_ops = {
-- 
2.27.0




  parent reply	other threads:[~2020-12-01  8:55 UTC|newest]

Thread overview: 29+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-12-01  8:53 [PATCH 4.4 00/24] 4.4.247-rc1 review Greg Kroah-Hartman
2020-12-01  8:53 ` [PATCH 4.4 01/24] btrfs: tree-checker: Enhance chunk checker to validate chunk profile Greg Kroah-Hartman
2020-12-01  8:53 ` [PATCH 4.4 02/24] btrfs: inode: Verify inode mode to avoid NULL pointer dereference Greg Kroah-Hartman
2020-12-01  8:53 ` [PATCH 4.4 03/24] KVM: x86: Fix split-irqchip vs interrupt injection window request Greg Kroah-Hartman
2020-12-01  8:53 ` [PATCH 4.4 04/24] HID: cypress: Support Varmilo Keyboards media hotkeys Greg Kroah-Hartman
2020-12-01  8:53 ` [PATCH 4.4 05/24] Input: i8042 - allow insmod to succeed on devices without an i8042 controller Greg Kroah-Hartman
2020-12-01  8:53 ` [PATCH 4.4 06/24] HID: hid-sensor-hub: Fix issue with devices with no report ID Greg Kroah-Hartman
2020-12-01  8:53 ` [PATCH 4.4 07/24] x86/xen: dont unbind uninitialized lock_kicker_irq Greg Kroah-Hartman
2020-12-01  8:53 ` [PATCH 4.4 08/24] proc: dont allow async path resolution of /proc/self components Greg Kroah-Hartman
2020-12-01  8:53 ` [PATCH 4.4 09/24] dmaengine: pl330: _prep_dma_memcpy: Fix wrong burst size Greg Kroah-Hartman
2020-12-01  8:53 ` [PATCH 4.4 10/24] scsi: libiscsi: Fix NOP race condition Greg Kroah-Hartman
2020-12-01  8:53 ` [PATCH 4.4 11/24] scsi: target: iscsi: Fix cmd abort fabric stop race Greg Kroah-Hartman
2020-12-01  8:53 ` [PATCH 4.4 12/24] scsi: ufs: Fix race between shutdown and runtime resume flow Greg Kroah-Hartman
2020-12-01  8:53 ` [PATCH 4.4 13/24] bnxt_en: fix error return code in bnxt_init_board() Greg Kroah-Hartman
2020-12-01  8:53 ` [PATCH 4.4 14/24] video: hyperv_fb: Fix the cache type when mapping the VRAM Greg Kroah-Hartman
2020-12-01  8:53 ` [PATCH 4.4 15/24] bnxt_en: Release PCI regions when DMA mask setup fails during probe Greg Kroah-Hartman
2020-12-01  8:53 ` [PATCH 4.4 16/24] IB/mthca: fix return value of error branch in mthca_init_cq() Greg Kroah-Hartman
2020-12-01  8:53 ` [PATCH 4.4 17/24] nfc: s3fwrn5: use signed integer for parsing GPIO numbers Greg Kroah-Hartman
2020-12-01  8:53 ` Greg Kroah-Hartman [this message]
2020-12-01  8:53 ` [PATCH 4.4 19/24] perf probe: Fix to die_entrypc() returns error correctly Greg Kroah-Hartman
2020-12-01  8:53 ` [PATCH 4.4 20/24] USB: core: Change %pK for __user pointers to %px Greg Kroah-Hartman
2020-12-01  8:53 ` [PATCH 4.4 21/24] x86/speculation: Fix prctl() when spectre_v2_user={seccomp,prctl},ibpb Greg Kroah-Hartman
2020-12-01  8:53 ` [PATCH 4.4 22/24] USB: core: add endpoint-blacklist quirk Greg Kroah-Hartman
2020-12-01  8:53 ` [PATCH 4.4 23/24] USB: core: Fix regression in Hercules audio card Greg Kroah-Hartman
2020-12-01  8:53 ` [PATCH 4.4 24/24] btrfs: fix lockdep splat when reading qgroup config on mount Greg Kroah-Hartman
2020-12-01 15:59 ` [PATCH 4.4 00/24] 4.4.247-rc1 review Pavel Machek
2020-12-01 21:38 ` Guenter Roeck
2020-12-02  6:17 ` Naresh Kamboju
2020-12-02 17:04 ` Shuah Khan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20201201084638.661650900@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=David.Laight@aculab.com \
    --cc=ardb@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=sashal@kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=vamshi.k.sthambamkadi@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).